Location data generated from our cell phones paint an incredibly detailed picture of our movements and private lives. Despite the sensitive nature of this data and a federal law prohibiting cellphone carriers from disclosing it, repeated unauthorized disclosures over the last several years show that carriers will sell this sensitive information to almost any willing buyer.

With cellphone carriers brazenly violating their customers’ privacy and the Federal Communication Commission moving slowly to investigate, it fell to consumers to protect themselves. That’s why in June 2019 EFF filed a lawsuit representing customers challenging AT&T’s unlawful disclosure of their location data. Our co-counsel are lawyers at Hagens Berman Sobol Shapiro LLP. The case, Scott v. AT&T, alleged that AT&T had violated a federal privacy law protecting cellphone customers’ location data, among other protections.

How AT&T Compelled Arbitration

That legal challenge, however, quickly ran into an all-too-familiar roadblock: the arbitration agreements AT&T forces on its customers to sign every time they buy a cellphone or new service from the company. AT&T claimed that this clause prevented the Scott case from proceeding.

The court ended up dismissing the plaintiffs’ lawsuit earlier this year. The way it did so demonstrates why Congress needs to change federal law so that the public can meaningfully protect themselves from companies’ abusive practices.

In response to the lawsuit, AT&T first moved to compel the plaintiffs to arbitration, arguing that because they had signed arbitration agreements—buried deep within an ocean of contract terms—they had no right to sue.

But under California law, AT&T cannot enforce contracts, like those at issue here, which prevent people from seeking court orders, called “public injunctions,” to prevent future harm to the public. California law also recognizes that these one-sided “contracts of adhesion” can sometimes be so unfair that they cannot be enforced. We argued that both of these principles voided AT&T’s contracts, emphasizing that our clients sought to prevent AT&T from disclosing all customers’ location data without their notice and consent to protect the broader public’s privacy and to prevent AT&T from publicly misrepresenting its practices moving forward.

AT&T responded by moving to dismiss the public injunction claims, asserting that because the company stopped disclosing customer location data to certain third parties identified in media reports, plaintiffs had no legal basis–known as standing–to seek a public injunction. AT&T’s strategy was clear: rather than admit that it had done anything wrong in the past, the company argued that because it had stopped disclosing customer location data, there was no future public harm that the court needed to prohibit via a public injunction. Because no public injunction was necessary, AT&T argued, California’s rule against the arbitration agreements did not apply and the plaintiffs remained subject to them.

We did not trust AT&T’s representations that it stopped disclosing customer location data, particularly because the company had previously promised to stop disclosing the same data, only for media reports to later show that the disclosures were ongoing. Additionally, AT&T was not clear about whether it had other programs or services that disclosed the same location data without customers’ knowledge and consent.

The plaintiffs spent months trying to learn more about AT&T’s location data sharing practices in the face of AT&T’s stonewalling. What we found was concerning: AT&T continued to disclose customer location data, including to enable commercial call routing by third-party services, without customers’ notice and consent. We asked the court to let the case proceed, arguing that this information undercut AT&T’s claims that it had stopped its harmful practices.

The court sided with AT&T. It ruled that the evidence did not establish that there was an ongoing risk that AT&T would disclose customer location data in the future and thus plaintiffs lacked standing to seek a public injunction. Next, the court upheld the legality of AT&T’s one-sided contracts and ruled that plaintiffs could be forced into arbitration.

We disagree with the court’s ruling in multiple respects. The court largely ignored evidence in the record showing that AT&T continues to disclose customer location data, putting all of its customers’ privacy at risk. It also mischaracterized plaintiffs’ allegations, allowing the court to avoid having to wrestle with AT&T’s ongoing privacy failures. Finally, the court failed to protect consumers subject to AT&T’s one-sided arbitration agreements—these contracts are fundamentally unfair and their continued enforcement is unjust.

Importantly, the court did not rule on the merits: it did not decide whether AT&T’s disclosure of customer location data was lawful. Instead, it sidestepped that question by deciding that the plaintiffs’ case didn’t belong in federal court.

Next Steps: Legislative Reform of Arbitration Agreements

The court’s decision to enforce AT&T’s arbitration agreement is problematic because it prevents consumers from vindicating their rights under a longstanding federal privacy law written to protect them. Unlike other areas of consumer privacy where comprehensive federal legislation is sorely needed, Congress has already prohibited phone services like AT&T from disclosing customer location data without notice and consent.

The legislative problem this case highlights is different: rather than writing a new law, Congress needs to amend an existing one—the Federal Arbitration Act. Arbitration was originally intended to allow large, sophisticated entities like corporations to avoid expensive legal fights. Today, however, it is used to prevent consumers, employees, and anyone with less bargaining power from having any meaningful redress in court. Congress can easily fix this injustice by prohibiting forced arbitration in one-sided contracts of adhesion, and it’s past time that they did so.

Likewise, when Congress enacts a comprehensive consumer data privacy law, it must bar enforcement of arbitration agreements that unfairly limit user enforcement of their legal rights in court. The better proposed bills do so.

Despite the federal court’s dismissal of the case against AT&T, we remain hopeful that the FCC will take action against the company for its disclosure of location data. The agency began an enforcement proceeding last year, and we hope that once President Biden appoints new FCC leadership, the agency will move quickly to hold AT&T accountable.